Ontario court considers "lawful authority" under PIPEDA

Thanks to the Canadian Information Technology Law Association's blog (http://www.it-can.ca/blog/?p=70) for ferreting out this interesting case from Ontario.

In Re S.C., 2006 ONCJ 343 (CanLII), a Justice of the Peace denied a police officer's application for a search warrant related to a specific individual. The police had obtained the individual's name and address from Bell, his internet service provider, who had provided it in response to a request "pursuant to PIPEDA". Oddly, the demand for information faxed to Bell strongly suggested that the ISP was required to provide the information because of PIPEDA.

The Justice of the Peace considered the consent exception contained in s. 7(3)(c.1)(iii) of PIPEDA, which reads:

(3) For the purpose of clause 4.3 of Schedule 1, and despite the note that accompanies that clause, an organization may disclose personal information without the knowledge or consent of the individual only if the disclosure is

. . .

(c.1) made to a government institution or part of a government institution that has made a request for the information, identified its lawful authority (emphasis added) to obtain the information and indicated that . . .

(ii) the disclosure is requested for the purpose of enforcing any law of Canada, a province or a foreign jurisdiction, carrying out an investigation relating to the enforcement of any such law or gathering intelligence for the purpose of enforcing any such law, or

The Justice of the Peace considered (the correct, in my view) application of that section:

[9] However, s. 7(3) stipulates that the information can be provided without consent only if the body seeking the information has "identified its lawful authority to obtain the information" and has indicated that the disclosure is requested (in this case) for law enforcement purposes. The Act does not set out that the existence of a criminal investigation is, in and of itself, “lawful authority” within the meaning of the Act nor, therefore, does a “Letter of Request for Account Information Pursuant to a Child Sexual Exploitation Investigation” establish such authority. Accordingly, there must still be some “legal authority” to obtain the information; in the view of this Court s. 7(3)(c.1)(ii) by itself does not establish what that “lawful authority” is. The section provides authority for disclosing information. It does not establish the authority for obtaining and possessing the information.

[10] The Information to Obtain does not otherwise reflect that the Informant established to Bell Canada the lawful authority, within the meaning of the Act, by which the investigators were seeking to obtain the requested information. Accordingly, Bell Canada did not have a basis upon which to disclose the information.

[11] In the absence of express authority within the legislation, the Charter right not to have one’s reasonable expectation of privacy interfered with, except through prior judicial authorization with all the protections that affords, must govern. Accordingly, it is the view of this Court that the Informant is not lawfully in possession of the information that was provided by Bell Canada. Therefore, that information must be set aside in the overall consideration of this application to obtain a search warrant.

[12] The balance of the information contained in the Information to Obtain does not, however, establish a reasonable nexus between the matters being investigated and the individual and residence identified as the targets for the warrant to search.

[13] Therefore, the request for a search warrant is denied.

In short, just because someone has a badge or official looking letterhead doesn't mean they have "lawful authority". The appropriate response to a request such as this is "come back with a warrant".